mirror of
https://github.com/elastic/detection-rules
synced 2026-06-08 14:00:08 +00:00
[New] EKS Access Entry Granted Cluster Admin Policy (#6091)
* [New] EKS Access Entry Granted Cluster Admin Policy
Detects when the AmazonEKSClusterAdminPolicy or AmazonEKSAdminPolicy is associated with a principal via the EKS
Access Entries API. This grants full cluster-admin equivalent access to the specified IAM user or role.
* Update rules/integrations/aws/persistence_eks_access_entry_modified.toml
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
* Update rules/integrations/aws/persistence_eks_access_entry_modified.toml
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
* Update rules/integrations/aws/privilege_escalation_eks_access_entry_granted_cluster_admin_policy.toml
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
* Update rules/integrations/aws/privilege_escalation_eks_access_entry_granted_cluster_admin_policy.toml
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
* Update rules/integrations/aws/privilege_escalation_eks_access_entry_granted_cluster_admin_policy.toml
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
* Update rules/integrations/aws/persistence_eks_access_entry_modified.toml
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
---------
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
(cherry picked from commit e4994a5478)
This commit is contained in:
Samirbous
committed by
tradebot-elastic
tradebot-elastic
parent
5b17d9d7ea
commit
3ca29eed6e
@@ -0,0 +1,127 @@
|
||||
[metadata]
|
||||
creation_date = "2026/05/06"
|
||||
integration = ["aws"]
|
||||
maturity = "production"
|
||||
updated_date = "2026/05/06"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
description = """
|
||||
Detects successful Amazon EKS Access Entries API operations that create, update, attach, detach, or delete authentication
|
||||
mappings between IAM principals and the cluster. Changes to access entries alter who can authenticate to Kubernetes and
|
||||
what Kubernetes-level permissions they receive, without requiring edits to in-cluster RBAC objects. Unexpected callers
|
||||
or timing may indicate persistence or privilege abuse. Common automation identities (service-linked roles, eksctl,
|
||||
Terraform, CloudFormation role patterns) are excluded to reduce noise; tune further for your deployment pipelines.
|
||||
"""
|
||||
false_positives = [
|
||||
"""
|
||||
Cluster provisioning, GitOps, or approved platform automation may perform these APIs under IAM principals whose ARNs do
|
||||
not match the exclusion patterns. Baseline expected roles and expand exclusions if needed.
|
||||
""",
|
||||
]
|
||||
from = "now-6m"
|
||||
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "AWS EKS Access Entry Modified"
|
||||
note = """## Triage and analysis
|
||||
|
||||
### Investigating AWS EKS Access Entry Modified
|
||||
|
||||
Review aws.cloudtrail.user_identity (ARN, type), user.name, source.ip, user_agent.original, cloud.account.id, and
|
||||
cloud.region. Map event.action to intent: new principal (CreateAccessEntry), policy binding changes (AssociateAccessPolicy,
|
||||
DisassociateAccessPolicy), metadata updates (UpdateAccessEntry), or removal (DeleteAccessEntry).
|
||||
|
||||
### Possible investigation steps
|
||||
|
||||
- Inspect aws.cloudtrail.request_parameters and response_elements for cluster name, principal ARN, and policy ARNs.
|
||||
- Compare against change management and infrastructure-as-code deploy windows.
|
||||
- Correlate with Kubernetes audit logs for subsequent API activity from identities tied to the affected access entry.
|
||||
- Pair with the higher-fidelity rule EKS Access Entry Granted Cluster Admin Policy when AssociateAccessPolicy fires.
|
||||
|
||||
### Response and remediation
|
||||
|
||||
- If unauthorized, revert access entry changes via AWS APIs or console; restrict eks:* permissions and review SCPs.
|
||||
- Rotate credentials for compromised IAM principals as appropriate.
|
||||
|
||||
### Additional information
|
||||
|
||||
- [Amazon EKS access entries](https://docs.aws.amazon.com/eks/latest/userguide/access-entries.html)
|
||||
"""
|
||||
references = [
|
||||
"https://docs.aws.amazon.com/eks/latest/userguide/access-entries.html",
|
||||
]
|
||||
risk_score = 47
|
||||
rule_id = "90c0ce77-3fb4-484f-a8ad-4648e12b35b1"
|
||||
severity = "medium"
|
||||
tags = [
|
||||
"Domain: Cloud",
|
||||
"Domain: Kubernetes",
|
||||
"Data Source: AWS",
|
||||
"Data Source: Amazon Web Services",
|
||||
"Data Source: AWS CloudTrail",
|
||||
"Use Case: Threat Detection",
|
||||
"Tactic: Persistence",
|
||||
"Tactic: Privilege Escalation",
|
||||
"Resources: Investigation Guide",
|
||||
]
|
||||
timestamp_override = "event.ingested"
|
||||
type = "query"
|
||||
query = '''
|
||||
data_stream.dataset:"aws.cloudtrail" and event.provider:"eks.amazonaws.com" and
|
||||
event.action:("CreateAccessEntry" or "AssociateAccessPolicy" or "UpdateAccessEntry" or "DisassociateAccessPolicy" or "DeleteAccessEntry") and
|
||||
event.outcome:"success" and
|
||||
not aws.cloudtrail.user_identity.arn:(*AWSServiceRoleForAmazonEKS* or *eksctl* or *terraform* or *AWSCloudFormation*)
|
||||
'''
|
||||
|
||||
[rule.investigation_fields]
|
||||
field_names = [
|
||||
"@timestamp",
|
||||
"user.name",
|
||||
"user_agent.original",
|
||||
"source.ip",
|
||||
"aws.cloudtrail.user_identity.arn",
|
||||
"aws.cloudtrail.user_identity.type",
|
||||
"event.action",
|
||||
"event.outcome",
|
||||
"cloud.account.id",
|
||||
"cloud.region",
|
||||
"aws.cloudtrail.request_parameters",
|
||||
"aws.cloudtrail.response_elements",
|
||||
]
|
||||
|
||||
[[rule.threat]]
|
||||
framework = "MITRE ATT&CK"
|
||||
|
||||
[[rule.threat.technique]]
|
||||
id = "T1098"
|
||||
name = "Account Manipulation"
|
||||
reference = "https://attack.mitre.org/techniques/T1098/"
|
||||
|
||||
[[rule.threat.technique.subtechnique]]
|
||||
id = "T1098.006"
|
||||
name = "Additional Container Cluster Roles"
|
||||
reference = "https://attack.mitre.org/techniques/T1098/006/"
|
||||
|
||||
[rule.threat.tactic]
|
||||
id = "TA0003"
|
||||
name = "Persistence"
|
||||
reference = "https://attack.mitre.org/tactics/TA0003/"
|
||||
|
||||
[[rule.threat]]
|
||||
framework = "MITRE ATT&CK"
|
||||
|
||||
[[rule.threat.technique]]
|
||||
id = "T1098"
|
||||
name = "Account Manipulation"
|
||||
reference = "https://attack.mitre.org/techniques/T1098/"
|
||||
|
||||
[[rule.threat.technique.subtechnique]]
|
||||
id = "T1098.006"
|
||||
name = "Additional Container Cluster Roles"
|
||||
reference = "https://attack.mitre.org/techniques/T1098/006/"
|
||||
|
||||
[rule.threat.tactic]
|
||||
id = "TA0004"
|
||||
name = "Privilege Escalation"
|
||||
reference = "https://attack.mitre.org/tactics/TA0004/"
|
||||
+133
@@ -0,0 +1,133 @@
|
||||
[metadata]
|
||||
creation_date = "2026/05/06"
|
||||
integration = ["aws"]
|
||||
maturity = "production"
|
||||
updated_date = "2026/05/06"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
description = """
|
||||
Detects when the AmazonEKSClusterAdminPolicy or AmazonEKSAdminPolicy is associated with a principal via the EKS
|
||||
Access Entries API. This grants full cluster-admin equivalent access to the specified IAM user or role. Unlike the
|
||||
legacy aws-auth ConfigMap which is only visible in Kubernetes audit logs, Access Entries modifications appear in
|
||||
CloudTrail, providing an additional detection surface. Attackers who have obtained IAM permissions to manage EKS
|
||||
access entries can use this API to backdoor cluster access for persistence, mapping attacker-controlled IAM
|
||||
identities to cluster-admin privileges without modifying any Kubernetes resources.
|
||||
"""
|
||||
false_positives = [
|
||||
"""
|
||||
Platform or security teams may legitimately associate these policies during cluster onboarding, break-glass admin
|
||||
setup, or controlled RBAC migrations from aws-auth. Validate the caller, change ticket, and target IAM principal.
|
||||
""",
|
||||
]
|
||||
from = "now-6m"
|
||||
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License v2"
|
||||
name = "AWS EKS Access Entry Granted Cluster Admin Policy"
|
||||
note = """## Triage and analysis
|
||||
|
||||
### Investigating AWS EKS Access Entry Granted Cluster Admin Policy
|
||||
|
||||
Successful AssociateAccessPolicy with AmazonEKSClusterAdminPolicy or AmazonEKSAdminPolicy binds highly privileged
|
||||
Kubernetes access to an IAM principal. Review who invoked the API (user.name, aws.cloudtrail.user_identity fields),
|
||||
source.ip, user_agent.original, cloud.account.id, and cloud.region.
|
||||
|
||||
### Possible investigation steps
|
||||
|
||||
- Parse aws.cloudtrail.request_parameters and response elements for cluster name, access entry ARN, and policy ARN.
|
||||
- Confirm whether the IAM principal receiving the policy is expected to have cluster-admin-class access.
|
||||
- Correlate with other EKS API calls (CreateAccessEntry, UpdateAccessEntry) and with Kubernetes audit activity from
|
||||
newly authorized principals.
|
||||
- Compare against change records for migrations from aws-auth or new administrator onboarding.
|
||||
|
||||
### Response and remediation
|
||||
|
||||
- If unauthorized, disassociate the policy or remove the access entry per AWS guidance; audit who can call eks:*
|
||||
APIs in IAM.
|
||||
- Rotate credentials for any suspected compromised IAM principal; review organizational SCPs and cluster auth mode.
|
||||
|
||||
### Additional information
|
||||
|
||||
- [Amazon EKS access entries](https://docs.aws.amazon.com/eks/latest/userguide/access-entries.html)
|
||||
- [AssociateAccessPolicy](https://docs.aws.amazon.com/eks/latest/APIReference/API_AssociateAccessPolicy.html)
|
||||
"""
|
||||
references = [
|
||||
"https://docs.aws.amazon.com/eks/latest/userguide/access-entries.html",
|
||||
"https://docs.aws.amazon.com/eks/latest/APIReference/API_AssociateAccessPolicy.html",
|
||||
]
|
||||
risk_score = 73
|
||||
rule_id = "9550ec87-e73c-4baa-ad44-e448a33fbc3d"
|
||||
severity = "high"
|
||||
tags = [
|
||||
"Domain: Cloud",
|
||||
"Domain: Kubernetes",
|
||||
"Data Source: AWS",
|
||||
"Data Source: Amazon Web Services",
|
||||
"Data Source: AWS CloudTrail",
|
||||
"Use Case: Threat Detection",
|
||||
"Tactic: Privilege Escalation",
|
||||
"Tactic: Persistence",
|
||||
"Resources: Investigation Guide",
|
||||
]
|
||||
timestamp_override = "event.ingested"
|
||||
type = "query"
|
||||
query = '''
|
||||
data_stream.dataset:"aws.cloudtrail" and
|
||||
event.provider:"eks.amazonaws.com" and
|
||||
event.action:"AssociateAccessPolicy" and
|
||||
event.outcome:"success" and
|
||||
aws.cloudtrail.request_parameters:(*AmazonEKSClusterAdminPolicy* or *AmazonEKSAdminPolicy*)
|
||||
'''
|
||||
|
||||
[rule.investigation_fields]
|
||||
field_names = [
|
||||
"@timestamp",
|
||||
"user.name",
|
||||
"user_agent.original",
|
||||
"source.ip",
|
||||
"aws.cloudtrail.user_identity.arn",
|
||||
"aws.cloudtrail.user_identity.type",
|
||||
"event.action",
|
||||
"event.outcome",
|
||||
"cloud.account.id",
|
||||
"cloud.region",
|
||||
"aws.cloudtrail.request_parameters",
|
||||
"aws.cloudtrail.response_elements",
|
||||
]
|
||||
|
||||
[[rule.threat]]
|
||||
framework = "MITRE ATT&CK"
|
||||
|
||||
[[rule.threat.technique]]
|
||||
id = "T1098"
|
||||
name = "Account Manipulation"
|
||||
reference = "https://attack.mitre.org/techniques/T1098/"
|
||||
|
||||
[[rule.threat.technique.subtechnique]]
|
||||
id = "T1098.006"
|
||||
name = "Additional Container Cluster Roles"
|
||||
reference = "https://attack.mitre.org/techniques/T1098/006/"
|
||||
|
||||
[rule.threat.tactic]
|
||||
id = "TA0004"
|
||||
name = "Privilege Escalation"
|
||||
reference = "https://attack.mitre.org/tactics/TA0004/"
|
||||
|
||||
[[rule.threat]]
|
||||
framework = "MITRE ATT&CK"
|
||||
|
||||
[[rule.threat.technique]]
|
||||
id = "T1098"
|
||||
name = "Account Manipulation"
|
||||
reference = "https://attack.mitre.org/techniques/T1098/"
|
||||
|
||||
[[rule.threat.technique.subtechnique]]
|
||||
id = "T1098.006"
|
||||
name = "Additional Container Cluster Roles"
|
||||
reference = "https://attack.mitre.org/techniques/T1098/006/"
|
||||
|
||||
[rule.threat.tactic]
|
||||
id = "TA0003"
|
||||
name = "Persistence"
|
||||
reference = "https://attack.mitre.org/tactics/TA0003/"
|
||||
Reference in New Issue
Block a user